US Market Entry · Australia · AUKUS Pillar 2 Defense & Aerospace Manufacturers
US market entry for Australian defense manufacturers: AUKUS cleared most of the trade, the excluded work is the build.
The AUKUS ITAR exemption moved roughly 70% of trilateral defense trade license-free, and it did not erase the barrier. An Excluded Technologies List still gates the most sensitive work, the relief runs only between vetted Authorized Users, and none of it waives CMMC or FOCI. For the work that still needs a US shop floor, I stand up and run the compliant operation, in the New England corridor.
The direct answer
How an Australian manufacturer enters the US defense market.
An Australian defense or aerospace manufacturer enters the US defense market by standing up a compliant US operation: a US entity, a US-person data boundary, and a floor at a CMMC Level 2 and ITAR-ready posture from the day it opens. The AUKUS ITAR exemption under section 126.7, finalized on December 30, 2025, moves roughly 70% of trilateral defense trade license-free, but it runs only between vetted Authorized Users, the Excluded Technologies List still gates the most sensitive work, and qualifying-country status is a procurement preference, not an ITAR or CMMC waiver. When the operation itself has to be American, the US-person data boundary is the build.
Australia sits in the AUKUS lane with the UK and the US, and that lane moved for real. The exemption makes roughly 70% of trilateral defense trade license-free, effective December 2025. It moves articles and technical data between Authorized Users. It does not give an Australian parent a US shop floor, the US-person data boundary a prime's CUI flowdown demands, or the domestic-content standing many programs require. Where the operation itself has to be American, onshoring is the answer the exemption cannot be.
The exemption also carries an Excluded Technologies List, and the December 2025 final rule declined to broaden it. The most valuable Pillar 2 domains are the ones most likely to sit on that list and still require a license or domestic handling, so the manufacturers with the highest-value US opportunity are often the ones it helps least. Reading which of your technical data the exemption covers, and which still needs a US operation, is where the work starts.
New England is the landing zone. The prime relationships, the supply base, and the compliance depth are already here. The pattern is proven at both ends of the market: Austal builds US Navy ships in Mobile, Alabama under a Special Security Arrangement despite its Australian ownership, and DroneShield runs its counter-drone and electronic-warfare work out of Warrenton, Virginia. A foreign-owned US defense operation is a funded reality, and an Australian parent gets an operator on the ground who builds and runs it.
Know your work class
Most Australian sub-tier work lands in one class.
Settle which class of defense work you are chasing before anyone quotes an Australian parent a timeline, because each class is a different build. Commercial and dual-use parts need a US entity and a clean quality system. Classified work needs a facility clearance and FOCI mitigation, the Special Security Arrangement structure Austal runs under, negotiated with DCSA and owned by your counsel.
Most sub-tier DoD manufacturing sits between them: controlled technical data, CUI, ITAR-controlled but unclassified. The AUKUS exemption moves some of that data between Authorized Users and leaves the rest under the standard regime. That class needs DDTC registration, a US-person data boundary, and CMMC Level 2 in the workflow, and a foreign-owned US entity can reach it without a facility clearance.
● The class I build and run
That middle class, CUI and ITAR-controlled but unclassified, is the class I build and run. It is where an Australian supplier's US operation lives, Authorized-User status or not.
The 90-day operating build
A compliant US floor in one quarter, built where the exemption stops.
The build runs in parallel, not in sequence: the gate you are racing will not wait for one phase to finish. Operating model, IT and OT environment, and compliance posture come up together.
Days 1 to 30
Diagnostic and design
Stand up the US operating model on paper and on the floor, and map with your export-control counsel which of your technical data the AUKUS exemption moves between Authorized Users and which still needs a US-person boundary.
Days 30 to 60
Stabilize and build
Bring the IT and OT environment to a CMMC and ITAR-ready posture from day one, not retrofitted later. Scope the CUI enclave tight around the data that stays controlled, including anything on the Excluded Technologies List, so the assessment stays sane and the parent's access is governed by design.
Days 60 to 90
Qualify and run
Sequence readiness evidence against the gate you are racing, coordinate the FOCI, Special Security Arrangement, and DDTC steps with your counsel, and hand your team a floor that holds after I step back.
The Australia lane, answered
Three questions an AUKUS Pillar 2 supplier asks first.
If the AUKUS ITAR exemption lowers the barriers, why do I still need a US operation?
Because the exemption moves articles and data between Authorized Users. It does not give you a US shop floor, a US-person data boundary for a prime's CUI flowdown, or the domestic-content standing many programs require. It makes about 70% of trilateral defense trade license-free, but the Excluded Technologies List still gates the most sensitive work and none of it waives CMMC or FOCI. When a program needs the operation itself to be American, near the prime and holding controlled data domestically, you stand one up.
Is Australia's qualifying-country status the same as an ITAR exemption?
No. They are two different regimes. Australia is a DFARS qualifying country under a reciprocal defense-procurement MOU, which gives your end products a procurement preference against Buy American restrictions. The AUKUS ITAR exemption is separate export-licensing relief among Authorized Users. Neither is a CMMC exemption, and neither clears FOCI. A foreign-owned US operation still builds the full US-person data boundary and the CMMC Level 2 posture.
Austal builds US Navy ships as an Australian company. Doesn't that prove foreign ownership is fine?
It proves the path exists, and shows what it requires. Austal USA works on sensitive US programs under a Special Security Arrangement negotiated with DCSA to mitigate its foreign ownership, and runs a full US operation in Alabama to do it. Foreign ownership is workable because the FOCI structure and the compliant operation are built. Your counsel owns the Special Security Arrangement. I own standing up and running the operation inside it.
What I own
The operations partner, not the law firm.
I stand up and run the compliant US operation: the floor, the operating model, the IT and OT build, the US-person data boundary, and the readiness evidence for the gate your prime set. Entity formation, FOCI mitigation, and site selection stay with your counsel and a site-selection advisor. I coordinate with them and own the operating outcome.